[Date Prev][Date Next] [Chronological] [Thread] [Top]

Re: windows authentication & openldap: explanation.

This thread is riight up the alley of my most recent headache. ;-)
First off let me warn you guys that I am a student and that I am working on a accedemic project.
Consequently, purchased solutions are out.

In order to authenticate a Windows based client I am trying to use the pGINA module with the LDAP plugin.
I've not be able to figure out the configureattion despite haveing a Unix ldap.conf that works to use as a base.
I can email this to anyone who wants to help.

Any tips I can get on this would be most helpful. Esepcailly any windows based trouble shooting tricks.
The windows based cleint is a Win2K box. I am basically trying to figure out the differenece between what the client is sending
and what the server expects.

Alternatively, if there is an easier (cheap) way to authenticate a Windows based client , I am all ears.


Jim C.

yes that does answer my question, thanks alot. and thanks to kevin for the links to pgina and psynch.

From: David Wright <ichbin@shadlen.org>
To: brian jones <bj_rui@hotmail.com>
CC: openldap-software@OpenLDAP.org
Subject: Re: windows authentication & openldap: explanation.
Date: Fri, 26 Jul 2002 14:51:47 -0700 (PDT)

How Unix authentication works:
1. Server (or /etc/passwd) stores a hashed password, e.g. "{ROT-1}tfdsfu"
2. Client hands server the cleartext of the user input, e.g. "secret"
3. Server hashes the client user input and compares it with the stored
hased password. If they match, it returns TRUE.

How Windows authentication works:
1. Server stores cleartext of the password, e.g. "secret".
2. Server sends client a challenge, e.g. "abcdef".
3. Client hashes the client input and the challenge together, e.g.
"tgfvjz" and sends this response to the server.
4. Server hases the client input and the challenge together and compares
to the client's response. If they match, it retuns TRUE.

The Windows authentication has the advantage that the cleartext password
is never sent over the wire. It the the disadvantage that the server must
store the cleartext password.

OpenLDAP is designed to store hashed passwords, as is the Unix tradition.
Since Windows authentication would require storing cleartext passwords,
OpenLDAP doesn't implement the challenge/response model of Windows

You can get around this limitation. You can store a hashed password in the
userPassword attribute and have your Unix clients authenticate off it via
LDAP. You can also store a cleartext password in the smbPassword attribute
and tell Samba to get passwords from LDAP. Samba implements the Windows
challenge/response model and your Windows clients can authenticate off it.

You then need to do some scheming to make sure that the userPassword and
smbPassword attributes stay in sync.

That answer you question?

MSN Photos is the easiest way to share and print your photos: http://photos.msn.com/support/worldwide.aspx